← All changes | callback/wings/security.php +142 -6 5.24 → 6.36 View file →

		@@ -1,16 +1,30 @@
1	1	<?php
2	2	if (!defined('ABSPATH')) exit;
3	3	if (!class_exists('BVSecurityCallback')) :
4	4	class BVSecurityCallback extends BVCallbackBase {
	5	+ private $settings;
	6	+
	7	+ public function __construct() {
	8	+ $this->settings = new WPRWPSettings();
	9	+ }
	10	+
	11	+ // phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
	12	+ // Here we need fread as we are using popen which returns a handler
5	13	function getCrontab() {
6	14	$resp = array();
7	15
8		- if (function_exists('exec') && exec('crontab -l', $output, $retval) !== false) {
9		- $resp["content"] = implode("\n", $output);
10		- $resp["status"] = "success";
11		- $resp["code"] = $retval;
12		- } elseif (function_exists('popen')) {
	16	+ if (function_exists('exec')) {
	17	+ $output = array();
	18	+ $retval = -1;
	19	+ $execRes = exec('crontab -l', $output, $retval);
	20	+ if ($execRes !== false && $execRes !== null) {
	21	+ $resp["content"] = implode("\n", $output);
	22	+ $resp["status"] = "success";
	23	+ $resp["code"] = $retval;
	24	+ }
	25	+ }
	26	+ if (empty($resp) && function_exists('popen')) {
13	27	$handle = popen('crontab -l', 'rb');
14	28	if ($handle) {
15	29	$output = '';
16	30	while (!feof($handle)) {
		@@ -25,14 +39,136 @@
25	39	}
26	40
27	41	return $resp;
28	42	}
	43	+ // phpcs:enable WordPress.WP.AlternativeFunctions.file_system_operations_fread
29	44
	45	+ public function setupWP2FA($secrets_by_uids, $to_encrypt, $cipher_algo, $enabled) {
	46	+ if (!is_array($secrets_by_uids)) {
	47	+ return array("status" => false, "message" => "secrets_by_uids is not an array.");
	48	+ }
	49	+
	50	+ $result = array();
	51	+ foreach ($secrets_by_uids as $user_id => $secret) {
	52	+ if (empty($user_id) || !is_string($secret)) {
	53	+ continue;
	54	+ }
	55	+
	56	+ if ($to_encrypt === true) {
	57	+ if (empty($cipher_algo)) {
	58	+ $cipher_algo = WPRWP2FA::$cipher_algo;
	59	+ }
	60	+
	61	+ if (defined('SECURE_AUTH_KEY')) {
	62	+ $encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
	63	+ if ($encryption_result[0] === false) {
	64	+ return array("status" => false, "message" => $encryption_result[1]);
	65	+ }
	66	+ $secret = $encryption_result[1];
	67	+ } else {
	68	+ return array("status" => false, "message" => "Encryption key not found.");
	69	+ }
	70	+ }
	71	+
	72	+ $secret_info = array(
	73	+ "secret" => base64_encode($secret),
	74	+ "is_encrypted" => $to_encrypt
	75	+ );
	76	+
	77	+ $result[$user_id][WPRWP2FA::SECRET_META_KEY] = update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
	78	+ $result[$user_id][WPRWP2FA::FLAG_META_KEY] = update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
	79	+ }
	80	+
	81	+ if (is_bool($enabled)) {
	82	+ $config = array("enabled" => $enabled);
	83	+ $result[WPRWP2FA::$wp_2fa_option] = $this->settings->updateOption(WPRWP2FA::$wp_2fa_option, $config);
	84	+ }
	85	+
	86	+ return array("status" => true, "result" => $result);
	87	+ }
	88	+
	89	+ public function verifyWP2FACode($user_id, $code, $cipher_algo = null) {
	90	+ $encoded_secret_info = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
	91	+
	92	+ $secret_info = WPRWP2FAUtils::getSecretInfo($encoded_secret_info);
	93	+ $secret = $secret_info['secret'];
	94	+ $is_secret_encrypted = $secret_info['is_encrypted'];
	95	+
	96	+ if (is_null($secret) || is_null($is_secret_encrypted)) {
	97	+ return array("status" => false, "message" => "Secret and encryption status not found.");
	98	+ }
	99	+
	100	+ if ($is_secret_encrypted === true) {
	101	+ if (empty($cipher_algo)) {
	102	+ $cipher_algo = WPRWP2FA::$cipher_algo;
	103	+ }
	104	+
	105	+ if (defined('SECURE_AUTH_KEY')) {
	106	+ $decryption_result = WPRHelper::opensslDecrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
	107	+ if ($decryption_result[0] === false) {
	108	+ return array("status" => false, "message" => $decryption_result[1]);
	109	+ }
	110	+ $secret = $decryption_result[1];
	111	+ } else {
	112	+ return array("status" => false, "message" => "Decryption key not found.");
	113	+ }
	114	+ }
	115	+
	116	+ return array("status" => WPRWP2FAAuthenticator::verifyCode($secret, $code, 2));
	117	+ }
	118	+
	119	+ public function readWP2FAKeys($user_id) {
	120	+ $secret = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
	121	+ $enabled = get_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
	122	+ return array(
	123	+ "secret" => $secret,
	124	+ "enabled" => $enabled
	125	+ );
	126	+ }
	127	+
	128	+ public function deleteWP2FAKeys($user_ids, $is_disable = false) {
	129	+ $result = array();
	130	+
	131	+ foreach ($user_ids as $user_id) {
	132	+ $secret_deleted = delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
	133	+ $flag_deleted = delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
	134	+ $result[$user_id] = array(
	135	+ WPRWP2FA::SECRET_META_KEY => $secret_deleted,
	136	+ WPRWP2FA::FLAG_META_KEY => $flag_deleted
	137	+ );
	138	+ }
	139	+
	140	+ if ($is_disable === true) {
	141	+ $result[WPRWP2FA::$wp_2fa_option] = $this->settings->deleteOption(WPRWP2FA::$wp_2fa_option);
	142	+ }
	143	+
	144	+ return array("status" => true, "result" => $result);
	145	+ }
	146	+
30	147	public function process($request) {
	148	+ $params = $request->params;
	149	+
31	150	switch ($request->method) {
32	151	case "gtcrntb":
33	152	$resp = $this->getCrontab();
34	153	break;
	154	+ case "stupwp2fa":
	155	+ $enable_wp_2fa = null;
	156	+ if (array_key_exists('enable_wp_2fa', $request->params)) {
	157	+ $enable_wp_2fa = $request->params['enable_wp_2fa'];
	158	+ }
	159	+
	160	+ $resp = $this->setupWP2FA($params['secrets_by_uids'], $params['to_encrypt'], $params['cipher_algo'], $enable_wp_2fa);
	161	+ break;
	162	+ case "vrfywp2fa":
	163	+ $resp = $this->verifyWP2FACode($params['user_id'], $params['code'], $params['cipher_algo']);
	164	+ break;
	165	+ case "rdwp2fa":
	166	+ $resp = $this->readWP2FAKeys($params['user_id']);
	167	+ break;
	168	+ case "dltewp2fa":
	169	+ $resp = $this->deleteWP2FAKeys($params['user_ids'], $params['is_disable']);
	170	+ break;
35	171	default:
36	172	$resp = false;
37	173	}
38	174
		@@ -38,5 +174,5 @@
38	174
39	175	return $resp;
40	176	}
41	177	}
42		-endif;
	178	+endif;